docs: swarm/services.md is one blurb per service, the host detail moves to the service's implementation page

Each service section lost its container, credential and metrics detail to a
Host setup section on its own implementation page, unchanged apart from links.
The four agentAuth option rows that sat above the page title moved into the
telemetry page's metrics option table.

docs/4-implementation/swarm/sso.md

@@ -184,3 +184,60 @@ upstream and compare three requests, not one:
 All three matter. A change that silently deleted the browser page would
 pass a deny-only check, and one that quietly stopped denying would pass a
 page-only check. The person who introduced the split verified it this way.
+
+## Host setup
+
+One authelia per swarm, in a `swarm-authelia` container, at
+`auth.<swarm-domain>`. Operator and agents are both subjects of the same
+provider, differentiated by roles and claims rather than by mechanism —
+there is one IdP and one auth path.
+
+The container sits on the hive bridge in a network namespace of its own and
+dials the store, the collector and its own public name through it. It binds
+no TCP port: the login server, the metrics listener and the bridge each
+listen on a unix socket in `/run/swarm-authelia`, a directory only the
+gateway's nginx and the container's processes can open.
+
+- **`deploy.authelia`** — run the container here.
+- **`swarm.authelia.url`** — where clients go to authenticate. Present
+  on **every** hive and the same value on all of them:
+  `https://<swarm.authelia.domain>`, whether or not this host runs the
+  container. Set it explicitly when joining a swarm whose IdP is under
+  another name.
+
+Agent subjects come from swarm-controller's agent-creation job, written
+into the users database by `swarm-authelia-bridge`; human ones come from
+`swarmctl user add` → [setup.md § 2](../../1-getting-started/setup.md#2--your-sso-account).
+
+The bridge listens on a unix socket on the authelia host, and the gateway
+publishes it as
+`https://<swarm.authelia.domain>/bridge/`, which is where
+`deploy.swarm-controller.authBridgeUrl` points by default on every host.
+It answers only swarm-controller's OIDC client
+(`swarm.controller.queueClientId`) and refuses every other token `403`.
+
+On first boot this module seeds the users database with a placeholder subject marked `disabled`, so authelia has a non-empty store to start against before any real account exists (`swarm-authelia.nix:873`). Authelia's session, storage and other keys live in the swarm secret store; the container copies them into place at start, seeded from the files an earlier release generated there, and generates them itself only where it has no store identity. Nothing rotates them automatically; replacing one
+invalidates data already written (sessions, the encrypted store), so
+that's an operator action.
+
+Storage is local sqlite and the notifier writes to a file. Both are
+small-deployment choices, and the scope is the justification: redis
+buys shared session state across replicas and there is one instance;
+SMTP exists to mail humans, and provisioning here is programmatic.
+
+The swarm collector scrapes authelia's own metrics at
+`https://<swarm.authelia.domain>/metrics`, whichever host runs the
+container. The gateway admits only the collector's OAuth2 client there;
+any other session gets `deny`.
+
+The container's `authelia-swarm-secrets` unit creates each client secret directly in
+the swarm secret store, under the secret publisher's own store leaf handed in as
+a system credential, and writes only the digest to disk; see
+[`credentials.md`](../../2-handbook/swarm/credentials.md). Authelia starts from its digests, so the IdP
+comes up while the store is down, and a unit that needs the store retries every
+30 seconds. The container's journal forwarder reads its client secret back from
+the store under the same leaf, and is off where the container has none.
+
+See [`sso.md`](../../2-handbook/swarm/sso.md) for bootstrapping the first user and the OIDC
+relying-party flow, and [`credentials.md`](../../2-handbook/swarm/credentials.md) for where authelia
+generates and reads each of its keys.